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DETAILED ACTION 



1. 



Claims 1-65 are presented for examination. 



Oatlt/Declaration 



2. 



An oath or declaration identifying this application by application number and filing date 



is required because the oath is missing or not filed. 



Claim Rejections - 35 USC §101 



3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or 
composition of matter, or any new and useful improvement thereof, may obtain a patent 
therefor, subject to the conditions and requirements of this title. 

4. Claim 65 is rejected under 35 U.S.C. 101 because the claimed invention is directed to 
non-statutory subject matter. It is not tangibly embodied as it is only software per se. It is 
suggested that the claimed subject matter "A computer program product. . should be changed 
to " A program stored on a computer-readable medium. . .". 

Claim Rejections - 35 USC §102 

5. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 
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(b) the invention was patented or described in a printed publication in this or a foreign 
country or in public use or on sale in this country, more than one year prior to the date of 
application for patent in the United States. 

6. Claims 1-9, 11-12, 14, 17-23, 26-27, 29-38, 40-41, 43, 46-52, 55-56, 58-63, and 65 are 

rejected under 35 U.S.C. 102(b) as being anticipated by Sudia et al. (Sudia, Patent No.: US 

6,209,091 Bl). 

As per claim 1, 29, and 58, Sudia teaches a method/system of authenticating a user of a second 
system where the user has an authenticated identity in a first system (col. 6 lines 54-65), 
comprising the steps of: 

the second system causing a key to be generated for use in the second system (col. 14 
lines 4-7); 

the second system generating a certificate for the key (col. 13 lines 66-col. 14 lines 4); 

and 

signing the certificate for the key using the authenticated identity of the user in the first 
system (col. 14 lines 14-26). 

As per claim 30, Sudia teaches a system for authenticating a user of a second system where the 
user has an authenticated identity in a first system, comprising: 

a device forming part of the second system (first device/device 2 generates a hash of the 
certificate generated by second device/device 1), the device having means for causing a key to be 
generated for use in the second system (col. 14 lines 4-7 and lines 16-33), 
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said device of the second system having means for generating a certificate for the key 
(col. 14 lines 4-7); and a second device forming part of the first system (lines 16-33; certificate 
of device 1 is hashed by device 2), 

the second device having means for storing information regarding the authenticated 
identity of the user in the first system (col. 9 lines 37-42), 

said second device further having means for communicating said information (col. 13 
lines 66-67); and 

wherein the device of the first system has means for receipt of said information from the 
second device (col. 13 lines 66-67), and further has means for signing the certificate for the key 
using the authenticated identity of the user in the first system (col. 14 lines 14-27). 

As per claim 59, Sudia teaches a device for authenticating a user of a second system where the 
user has an authenticated identity in a first system, wherein the device forms part of the second 
system comprising: 

means for generating a key for use in the second system (col. 14 lines 4-7); 

means for generating a certificate for the key (col. 13 lines 66-col. 14 lines 4); 

means for transferring the certificate to a device forming part of the first system (col. 13 
lines 66-67, and col. 14 lines 16-19), said device of the first system having information 
concerning the authenticated identity of the user in the first system, so as to sign the certificate 
using the authenticated identity of the user in the first system (col. 14 lines 16-33); and 

wherein said device of the second system (device 1) further comprises means for receipt 
of said signed certificate (col. 15 lines 61-64) and means for transferring the signed certificate to 
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a third party of said second system (col. 15 lines 16-19). 

As per claim 60, Sudia teaches a wireless device for use in authenticating a user of a second 
system where the user has an authenticated identity in a first system associated with the wireless 
device, wherein the second system includes a device having means for causing a key to be 
generated for use in the second system, means for generating a certificate for the key, and means 
for transferring the certificate to another device; 

wherein the wireless device (col. 9 lines 51-57) comprises: 

means for storing information regarding the authenticated identity of the user in the first 

system (col. 9 lines 37-42); 

means for receipt of the certificate from the second device (col. 13 lines 66-67); and 
means for signing the certificate using the authenticated identity of the user in the first 

system and transferring the signed certificate to the device of the second system (col. 14 lines 14- 

22; certificate of device 1 is signed by device 2). 

As per claim 65, Sudia teaches a computer program product for implementing the authentication 
of a user of a second system where the user has an authenticated identity in a first system, 
comprising: 

a computer readable medium; 

a device forming part of the second system (first device/device 2 generates a hash of the 
certificate generated by second device/device 1), the device having program code in said 
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computer readable medium for generating a key for use in the second system (col. 14 lines 4-7 
and lines 16-33), 

said device of the second system having program code in said computer readable medium 
for generating a certificate for the key (lines 16-33; certificate of device 1 is hashed by device 2); 
and 

a second device forming part of the first system, the second device having program code 
in said computer readable medium for storing the authenticated identity of the user in the first 
system (col. 9 lines 37-42); and 

wherein the second device has program code in said computer readable medium for 
signing the certificate generated by the device of the second system using the information 
regarding the authenticated identity of the user in the first system and transferring the signed 
certificate to the device of the second system (col. 14 lines 14-27). 

As per claims 2, 3 1, and 61, Sudia teaches a method, wherein the key is generated by the second 
system (col. 24 lines 30-31, and fig. 23). 

As per claims 3 and 62, Sudia teaches a method, wherein the key is generated by the first system 
(col. 12 lines 55-57). 

As per claims 4 and 33, Sudia teaches a method/system, further comprising the step of: a third 
party communicating with the user of the second system (col. 15 lines 61-64) and verifying the 
user of the second system by the authenticated identity of the user of the first system (col. 15 
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As per claims 5 and 34, Sudia teaches a method/system, wherein the third party is a server (col. 6 
lines 54-61). 

As per claims 6 and 35, Sudia teaches a method/system, wherein the key comprises a private- 
public key pair and where the certificate includes the public key of the key pair (col. 14 lines 1-4, 
and col. 6 lines 54-61). 

As per claims 7 and 36, Sudia teaches a method/system, wherein the certificate further includes 
an identity which is the same as the authenticated identity of the user of the first system (col. 14 
lines 1-4). 

As per claims 8, 14, 37, 43, and 63, Sudia teaches a method/system/apparatus, where the 
authenticated identity of the user in the first system comprises a private-public key pair and a 
certificate issued by a Certification Authority, and where the signing of the second system 
generated certificate is by hashing at least some data in the certificate to obtain a hash value, 
encrypting this hash value using the private key of the first system private-public key pair, and 
adding the encrypted hash value to the certificate (col. 14 lines 16-33). 

As per claims 9 and 12, Sudia teaches a method, wherein the private key of first system private- 
public key pair is stored in a wireless identity module (col. 9 lines 51-57). 



« 
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As per claims 1 1 and 40, Sudia teaches a method/system, where the identity of the user in the 
first system comprises a private-public key pair and an associated certificate issued by a 
Certification Authority (col. 6 lines 54-65, and col. 15 lines 61-64). 

As per claims 17 and 46, Sudia teaches a method/system, wherein the certificate for the key 
includes the full certification tree for the key, said full certification tree including a certificate of 
the first system for the user of the first system (fig. 9 No. 141). 

As per claims 18 and 47, Sudia teaches a method/system, wherein the first system is a wireless 
communication system (col. 9 lines 51-57). 

As per claims 19 and 48, Sudia teaches a method/system, wherein the second system a computer 
connected to the Internet (fig. 1 No. 21). 

As per claims 20 and 49, Sudia teaches a method/system, wherein the second system uses a 
security protocol for establishing a secure session (col. 7 lines 42-49). 

As per claims 21 and 50, Sudia teaches a method/system, wherein the security protocol is 
selected from the group consisting of Transport Layer Security, IP Security Protocol and Secure 
Socket Layer (col. 9 lines 3-4). 
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As per claims 22 and 51, Sudia teaches a method/system, wherein the wireless communication 
system uses a wireless identity module (WIM) in an associated wireless device of the user of the 
first system for establishing the identity of the user of the first system (col. 9 lines 51-57). 

As per claims 23 and 52, Sudia teaches a method/system, wherein the WIM contains a private 
key of the user of the first system and wherein a corresponding public key of the user of the first 
system is certified by a Certification Authority (col. 6 lines 54-61, and col. 15 lines 16-19). 

As per claims 26 and 55, Sudia teaches a method/system, wherein an accepted operation is the 
use of the key for use in the second system for encryption of data but not for signature 
verification (col. 6 lines 61-63, and col. 23 lines 27-28). 

As per claims 27 and 56, Sudia teaches a method/system, where the certificate does not contain 
the identity of the user associated with the user generated key, and where the signing of the 
certificate using the authenticated identity of the user of the first system includes appending the 
full certification tree of the first user to the user generated key (fig. 9 No. 141). 

As per claim 32, Sudia teaches a system, wherein the second device forming part of the first 
system further comprises means for generating said key (col. 14 lines 4-7). 

As per claims 38 and 41, Sudia teaches a system, wherein the private key of the first system 



* 
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private-public key pair is stored in a wireless identity module forming part of the second device 
(col. 9 lines 37-42, and col. 9 lines 51-57). 



Claim Rejections - 35 USC §103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a whole 
would have been obvious at the time the invention was made to a person having ordinary 
skill in the art to which said subject matter pertains. Patentability shall not be negatived 
by the manner in which the invention was made. 

8. Claims 10, 13, 15-16, 39, 42, 44-45, and 64 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Sudia et al. (Sudia, Patent No.: US 6,209,091 Bl), and further in view of 
Wheeler et al. (Wheeler, Patent No.: US 6,892,302 B2). 

As per claims 10, 13, 15, 39, 42, 44, and 64, Sudia teaches all the subject matter as described 
above. Sudia fails to disclose password authentication to access private key prior to signing the 
certificate. 

However Wheeler teaches a method, wherein prior to signing the certificate for the key for use in 
the second system, the user of the first system obtains access to its private key by entry of a 
password (Wheeler col. 2 lines 48-53). 

Therefore it would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to employ the teachings of Wheeler within the system of Sudia because 
they are analogues art in generating a certificate (Wheeler col. 2 lines 49-53). One in the art 
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would have been motivated to incorporate the teachings of Wheeler into Sudia because it would 
guard against fraudulent use of a device through theft of the device (Wheeler col. 2 lines 48-53). 

As per claims 16 and 45, Sudia and Wheeler teach all the subject matter as described above. In 
addition, Wheeler teaches a method/system, wherein the password is a personal identification 
number (Wheeler col. 2 lines 48-53). The rational for combining are the same as claim 10 above. 

9. Claims 24-25, 28, 53-54, and 57 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Sudia et al. (Sudia, Patent No.: US 6,209,091 Bl), and Wheeler et al. 
(Wheeler, Patent No.: US 6,892,302 B2), and further in view of Hurtado et al. (Hurtado, Patent 
No.: US 6,418,421 Bl). 

As per claims 24 and 53, Sudia and Wheeler teach all the subject matter as described above. 
Sudia and Wheeler fail to disclose usage limitations. However Hurtado discloses a 
method/system, wherein the certificate for the key for use in the second system contains one or 
more usage limitations (Hurtado col. 9 lines 56-65, and fig. 5 element 533). 

Therefore it would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to employ the teachings of Hurtado within the combination system of 
Sudia and Wheeler because they are analogous in certificate and digital signature (Hurtado col. 
24 lines 58-63). One in the art would have been motivated to incorporate the teachings of 
Hurtado into Sudia and Wheeler because it would specify content usage conditions by granting 
or restricting access to the user (Hurtado col. 12 lines 25-27) 
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As per claims 25 and 54, Sudia, Wheeler, and Hurtado teach all the subject matter as described 
above. In addition, Hurtado teaches a method/system, wherein one usage limitation is that a third 
party of the second system should accept the key for use in the second system only for certain 
types of operations (Hurtado col. 9 lines 56-65, and fig. 5 element 533). The rational for 

combining are the same as claim 24 above. 

« 

As per claims 28 and 57, Sudia, Wheeler, and Hurtado teach all the subject matter as described 
above. In addition, Hurtado teaches a method/system, where the first and second users are the 
same entity (Hurtado col. 1 1 lines 36-43; content that has usages and signature is played on 
various devices of the End-user). The rational for combining are the same as claim 24 above. 

10. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Eleni A. Shiferaw whose telephone number is 571-272-3867. 
The examiner can normally be reached on Mon-Fri 8:00am-5 :00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz R. Sheikh can be reached on 571-272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 



Application/Control Number: 10/090,422 



Page 13 



Art Unit: 2136 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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